Our SharePoint farm consists of multiple web applications - we would like provided a SSO experience for our employees whether they are working from an unmanaged machine (ex:home PC) or managed machine (ex:work PC).
We would accomplish this using SAML authentication (via ADFS) for unmanaged machines and Windows Authentication for managed machines. If we were to implement this, does that mean we would have to apply permissions twice for each user. Example: for Employee A to access Site A, would we have to apply the identifier claim (which would be Employee A's email in our case) and the SAMAccountName for Windows authentication as permissions on Site A?
We it be better off just to provide a single path for authentication - SAML authentication for unmananged and managed PC's? How do other companies deal with this challenge?